Page 1 of 1
Translate Plugin
Posted: Tue Dec 15, 2015 5:25 pm
by Envera IT
I was looking to use the Translate plugin
https://www.elastic.co/guide/en/logstas ... slate.html but didn't see it listed in the NLS filesystem (probably because its a community maintained plugin). Maybe theres a different way to accomplish what I'm trying to do.
I have a firewall log that references a number of values (hundreds) in different scenarios. I'd like to be able to do a dictionary lookup on a YAML file formatted like this.
Code: Select all
"0": HOPOPT
"1": ICMP
"2": IGMP
"3": GGP
"4": IP-in-IP
"5": ST
"6": TCP
"7": CBT
"8": EGP
"9": IGP
"10": BBN-RCC-MON
"11": NVP-II
"12": PUP
etc
etc
etc
So if "1" replace with ICMP. Whats the best way to do something like that using the installed plugins? Would rather not need to write massive filters to grok replace.
Re: Translate Plugin
Posted: Tue Dec 15, 2015 6:02 pm
by jolson
You can install the translate plugin by issuing the following command:
Code: Select all
/usr/local/nagioslogserver/logstash/bin/logstash install logstash-filter-translate
After installing the translate plugin, I imagine you'll have no problem trying to parse out your YAML.
Re: Translate Plugin
Posted: Tue Dec 15, 2015 6:22 pm
by Envera IT
jolson wrote:You can install the translate plugin by issuing the following command:
Code: Select all
/usr/local/nagioslogserver/logstash/bin/logstash install logstash-filter-translate
After installing the translate plugin, I imagine you'll have no problem trying to parse out your YAML.
That helped get me looking in the right direction. I had to run /usr/local/nagioslogserver/logstash/bin/plugin install logstash-filter-translate
Install went fine, thanks!
Re: Translate Plugin
Posted: Wed Dec 16, 2015 10:07 am
by jolson
Oh crud, my bad! I even typed it correctly in my terminal - not sure what I was thinking.
I'm glad you got this working, is there anything else I can help you with?
Re: Translate Plugin
Posted: Wed Dec 16, 2015 12:48 pm
by Envera IT
jolson wrote:Oh crud, my bad! I even typed it correctly in my terminal - not sure what I was thinking.
I'm glad you got this working, is there anything else I can help you with?
At the moment I'm good on this issue. I have other questions that I'll eventually open another thread on as they differ so much from this topic. As always thanks for your help!
Re: Translate Plugin
Posted: Wed Dec 16, 2015 1:20 pm
by jolson
Sounds great, I'll close it out.
Jesse